# Sfoffo - Pentesting Notes ## Sfoffo - Pentesting Notes - [/home/sfoffo/.pt-notes](https://notes.sfoffo.com/readme.md) - [Active Directory](https://notes.sfoffo.com/active-directory.md) - [Initial Access](https://notes.sfoffo.com/active-directory/initial-access.md) - [Internal Enumeration & Lateral Movement](https://notes.sfoffo.com/active-directory/internal-enumeration-and-lateral-movement.md) - [Privilege Escalation to Domain Admin using Known Exploits](https://notes.sfoffo.com/active-directory/privilege-escalation-to-domain-admin-using-known-exploits.md) - [Domain Trusts](https://notes.sfoffo.com/active-directory/domain-trusts.md) - [Linux Privilege Escalation](https://notes.sfoffo.com/linux-privilege-escalation.md) - [Enumerating Attack Vectors](https://notes.sfoffo.com/linux-privilege-escalation/enumerating-attack-vectors.md) - [Privileged Groups](https://notes.sfoffo.com/linux-privilege-escalation/privileged-groups.md) - [Environment Variables Abuse](https://notes.sfoffo.com/linux-privilege-escalation/environment-variables-abuse.md) - [Capabilities Abuse](https://notes.sfoffo.com/linux-privilege-escalation/capabilities-abuse.md) - [Programs, Jobs and Services](https://notes.sfoffo.com/linux-privilege-escalation/programs-jobs-and-services.md) - [Miscellaneous Techniques](https://notes.sfoffo.com/linux-privilege-escalation/miscellaneous-techniques.md) - [Windows Privilege Escalation](https://notes.sfoffo.com/windows-privilege-escalation.md) - [Enumerating Attack Vectors](https://notes.sfoffo.com/windows-privilege-escalation/enumerating-attack-vectors.md) - [Excessive User Rights Abuse](https://notes.sfoffo.com/windows-privilege-escalation/excessive-user-rights-abuse.md) - [Built-in Groups Abuse](https://notes.sfoffo.com/windows-privilege-escalation/built-in-groups-abuse.md) - [File System ACLs](https://notes.sfoffo.com/windows-privilege-escalation/file-system-acls.md) - [Services Hijacking](https://notes.sfoffo.com/windows-privilege-escalation/unquoted-service-paths.md) - [User Account Control (UAC) Bypass](https://notes.sfoffo.com/windows-privilege-escalation/user-account-control-uac-bypass.md) - [Living off the Land](https://notes.sfoffo.com/windows-privilege-escalation/living-off-the-land.md) - [Bug Bounty Hunting](https://notes.sfoffo.com/bug-bounty-hunting.md) - [Bug Bounty Tools](https://notes.sfoffo.com/bug-bounty-hunting/bug-bounty-tools.md) - [Web Applications](https://notes.sfoffo.com/web-applications.md) - [Web Attacks](https://notes.sfoffo.com/web-applications/web-attacks.md) - [Cross Site Scripting (XSS)](https://notes.sfoffo.com/web-applications/web-attacks/cross-site-scripting-xss.md) - [CSRF](https://notes.sfoffo.com/web-applications/web-attacks/csrf.md) - [File Upload Vulnerabilities](https://notes.sfoffo.com/web-applications/web-attacks/file-uploads.md) - [NoSQL Injection](https://notes.sfoffo.com/web-applications/web-attacks/nosql-injection.md) - [JSON Web Tokens (JWTs)](https://notes.sfoffo.com/web-applications/web-attacks/json-web-tokens-jwts.md) - [SQL Injection (SQLi)](https://notes.sfoffo.com/web-applications/web-attacks/sql-injection.md) - [SSRF](https://notes.sfoffo.com/web-applications/web-attacks/ssrf.md) - [OAuth Attacks](https://notes.sfoffo.com/web-applications/web-attacks/oauth-attacks.md) - [SAML Attacks](https://notes.sfoffo.com/web-applications/web-attacks/saml-attacks.md) - [Insecure Direct Object References (IDOR)](https://notes.sfoffo.com/web-applications/web-attacks/insecure-direct-object-references-idor.md) - [OS Command Injection](https://notes.sfoffo.com/web-applications/web-attacks/os-command-injection.md) - [Web Cache Poisoning](https://notes.sfoffo.com/web-applications/web-attacks/web-cache-poisoning.md) - [Local File Inclusion (LFI)](https://notes.sfoffo.com/web-applications/web-attacks/local-file-inclusion-lfi.md) - [Remote File Inclusion (RFI)](https://notes.sfoffo.com/web-applications/web-attacks/remote-file-inclusion-rfi.md) - [XML External Entities (XXE)](https://notes.sfoffo.com/web-applications/web-attacks/xml-external-entities-xxe.md) - [XPath Injection](https://notes.sfoffo.com/web-applications/web-attacks/xpath-injection.md) - [LDAP Injection](https://notes.sfoffo.com/web-applications/web-attacks/ldap-injection.md) - [HTTP Verb Tampering](https://notes.sfoffo.com/web-applications/web-attacks/http-verb-tampering.md) - [Web Technologies](https://notes.sfoffo.com/web-applications/web-technologies.md) - [Tomcat](https://notes.sfoffo.com/web-applications/web-technologies/tomcat.md) - [CGI Applications](https://notes.sfoffo.com/web-applications/web-technologies/cgi-applications.md) - [WordPress](https://notes.sfoffo.com/web-applications/web-technologies/wordpress.md) - [PDF Generators](https://notes.sfoffo.com/web-applications/web-technologies/pdf-generators.md) - [Microsoft IIS](https://notes.sfoffo.com/web-applications/web-technologies/microsoft-iis.md) - [WebDav](https://notes.sfoffo.com/web-applications/web-technologies/webdav.md) - [IBM WebSphere](https://notes.sfoffo.com/web-applications/web-technologies/ibm-websphere.md) - [SAP Netweaver](https://notes.sfoffo.com/web-applications/web-technologies/sap-netweaver.md) - [Joomla](https://notes.sfoffo.com/web-applications/web-technologies/joomla.md) - [Drupal](https://notes.sfoffo.com/web-applications/web-technologies/drupal.md) - [Gitlab](https://notes.sfoffo.com/web-applications/web-technologies/gitlab.md) - [Jenkins](https://notes.sfoffo.com/web-applications/web-technologies/jenkins.md) - [Fuzzing](https://notes.sfoffo.com/web-applications/fuzzing.md) - [Information Gathering](https://notes.sfoffo.com/information-gathering.md) - [Protocols and Services](https://notes.sfoffo.com/protocols-and-services.md) - [DNS](https://notes.sfoffo.com/protocols-and-services/dns.md) - [FTP](https://notes.sfoffo.com/protocols-and-services/ftp.md) - [IMAP](https://notes.sfoffo.com/protocols-and-services/imap.md) - [IPMI](https://notes.sfoffo.com/protocols-and-services/ipmi.md) - [MSSQL](https://notes.sfoffo.com/protocols-and-services/mssql.md) - [MySQL](https://notes.sfoffo.com/protocols-and-services/mysql.md) - [NFS](https://notes.sfoffo.com/protocols-and-services/nfs.md) - [Oracle TNS](https://notes.sfoffo.com/protocols-and-services/oracle-tns.md) - [POP3](https://notes.sfoffo.com/protocols-and-services/pop3.md) - [RDP](https://notes.sfoffo.com/protocols-and-services/rdp.md) - [SMB](https://notes.sfoffo.com/protocols-and-services/smb.md) - [SMTP](https://notes.sfoffo.com/protocols-and-services/smtp.md) - [SNMP](https://notes.sfoffo.com/protocols-and-services/snmp.md) - [Utilities, Scripts and Payloads](https://notes.sfoffo.com/utilities-scripts-and-payloads.md) - [Shells and Payloads](https://notes.sfoffo.com/utilities-scripts-and-payloads/shells-and-payloads.md) - [Metasploit Framework](https://notes.sfoffo.com/utilities-scripts-and-payloads/metasploit-framework.md) - [File Transfers](https://notes.sfoffo.com/utilities-scripts-and-payloads/file-transfers.md) - [Pivoting, Tunneling, Port Forwarding](https://notes.sfoffo.com/utilities-scripts-and-payloads/pivoting-tunneling-port-forwarding.md) - [Password Attacks](https://notes.sfoffo.com/utilities-scripts-and-payloads/password-attacks.md)